CVE-2026-47888: CWE-401 Missing Release of Memory after Effective Lifetime in Spring Spring Framework

This vulnerability in Spring Framework arises from improper memory management in the RSocket component, specifically triggered by a malformed SETUP frame. The affected versions include Spring Framework 5.2.0.RELEASE through 5.2.25.RELEASE, 5.3.0 through 5.3.49, 6.0.0 through 6.0.30, 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. The flaw leads to a memory leak, which can degrade application performance or cause denial of service due to resource exhaustion. The CVSS v3.1 base score is 7.5 (high), with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (no confidentiality or integrity impact). No known exploits in the wild or official remediation details are currently available.

Successful exploitation results in a memory leak in affected Spring RSocket applications, potentially leading to degraded performance or denial of service conditions due to resource exhaustion. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider mitigating exposure by restricting access to RSocket endpoints or applying network-level controls to limit malformed frame injection. Monitor vendor channels for updates and patches.